Google dismantles XCPE botnet that hijacked 1.3 million set-top boxes

Google and a group of industry partners have dismantled the XCPE backdoor, a botnet that enrolled more than 1.3 million set-top boxes into criminal service. The search company attributed the operation with high confidence to Videostrong Technology Co., an Android OEM and original design manufacturer, which it says built, deployed and ran the backdoor for financial gain.

Writing in the Google Cloud blog, the Google Threat Intelligence Group said Videostrong monetised the backdoor by selling access to criminal affiliates and loading their malware modules onto infected devices. Those secondary modules ran ad-fraud schemes, silently enrolled devices into residential proxy networks, and installed still more malware onto compromised hardware.

"We found this malicious software built directly into many different device models and brands over multiple years, supported by dedicated infrastructure and constantly evolving configurations to evade detection and manage their affiliates," the group reported. "We believe this campaign wasn't an isolated rogue insider or a development oversight."

How did the malware get past Google's checks?

Google requires Android OEMs to pass a comprehensive suite of compatibility and security tests before devices ship with its apps. Videostrong used obfuscation techniques to exploit a gap in those tests, loading its malicious code only after a device's first boot. Google says it has now changed its review process to guard against similar tricks.

The company framed the incident as a breach of the trust that underpins the Android TV ecosystem. Without users' knowledge or consent, infected devices became a distribution channel for a wide range of criminal actors. The resulting activity included ad-fraud, data exfiltration and the routing of malicious network traffic through home hardware.

What action has Google taken?

The disruption effort combined legal takedowns, a partner ban and engineering changes:

• Legal action to seize the domains and servers Videostrong used to control the botnet and install malware modules
• Legal action to take down command-and-control (C2) domains used by more than a dozen malware families loaded as modules via the backdoor
• A ban on Videostrong and any future subsidiaries or affiliates building or selling certified Android devices, or supplying software to other certified vendors
• Improvements to how Google verifies the integrity of firmware on certified Android TV devices

Google also targeted the C2 infrastructure serving the criminal affiliates. Because each affiliate distributes its modules through channels beyond XCPE, the company estimates that taking down their C2 domains will sever access to at least 10 million additional compromised devices.

Who helped with the takedown?

Google worked with Japan's National Police Agency alongside Lumen, HUMAN Security, Plume, Synthient and TrendAI to analyse the malware ecosystem and disrupt its operations. The mix of law enforcement, network operators and security vendors reflects how the criminal economy behind the botnet spans ad-fraud rings, residential proxy providers and backdoor operators.

That interconnection is central to Google's assessment of what comes next. "Point-in-time disruptions are a critical tool to protect our users, but lasting disruption in this fluid ecosystem will require continued targeting of this infrastructure," the company said, adding that it expects the operation to have a significant effect on the criminal groups involved.

The ban on Videostrong is permanent in scope, covering future subsidiaries and affiliates as well as the company itself. For Android device makers, the case sets a clear precedent: shipping preloaded malware now costs access to the certified Android ecosystem entirely, and Google's tightened firmware review process will apply to every certified Android TV device going forward.